In Case You Missed It

Retail & Hospitality ISAC and Security Innovation to Host Inaugural Security Awareness Symposium

The virtual event on Oct. 26 will offer multiple sessions, hands-on training exercises for both technical and non-technical audiences, and speakers from leading corporations.

Vienna, VA - The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) announced today it is partnering with Security Innovation to provide in-depth cybersecurity training for employees across the retail and hospitality sector during Cybersecurity Awareness Month this October.

The inaugural Security Awareness Symposium is a virtual, full-day event that will take place on Tuesday, October 26, and is ideal for general employees, IT personnel, and security partners across the organization. The morning program includes different sessions on "The Future of Secure Work" and "Phishing & Social Engineering" while the afternoon program provides hands-on training for technical and non-technical staff.

For the technical track, Security Innovation will provide a hands-on hacking challenge leveraging Shred Skateboards, one of their CMD+CTRL Web Application Cyber Ranges. Shred is a fully functional eCommerce platform that represents the threats and attacks commonly seen in Retail & Hospitality IT systems. With over 35 different vulnerabilities, players try to buy items in an unintended way, crack passwords, tamper with other users' functionality, and conduct other nefarious acts. This hands-on experience builds an attack mentality and reinforces the implications of insecure software development practices.

The closing keynote will feature a panel discussion about the growing risk that third-party and supply chain vendors can create for organizations. Ed Adams, CEO of Security Innovation, will moderate and the panelists will be Kara Gunderson, Director of Payment Card Operations at CITGO Petroleum, Mark Carl, Chief Security Officer of PDI Software, and Devon Bryan, Global Chief Information Security Officer of Carnival Cruise Line.

"The retail and hospitality industry continues to be a target of cybersecurity attacks. RH-ISAC is doing outstanding work sharing valuable cybersecurity practices across its membership," said Ed Adams, President, and CEO of Security Innovation. "We are thrilled to be a part of this event that is addressing software security awareness at both the business and technical level."

Registration is open to all companies that are currently RH-ISAC members as well as non-member organizations in the retail, hospitality, and travel sector, including retailers, restaurants, hotels, gaming casinos, food retailers, consumer products, and other consumer-facing companies. Visit rhisac.org/SecurityAwareness for more event information and to register.
 

Retail Sector is a Top Target for Cyberattacks
Now Is The Time To Button Up Your Direct-To-Consumer Brand Data Security
In today's retail world, if you have not suffered a data breach or security compromise, consider yourself lucky. More and more, e-commerce brands across categories fall victim to cyberattacks. In fact, over the past three years, retail has been one of the most targeted sectors for virtual sieges.

As online merchants, consumers entrust you with their personal information, making a strong data protection strategy a cornerstone of any successful e-commerce business. But, when even the Apples and Nikes of the world have difficulty fending off these attacks, it can seem hopelessly difficult for smaller direct-to-consumer (DTC) players to protect themselves and their customers. With the threat of breaches only continuing to rise, retailers of all sizes should not be deterred from shoring up their defenses.

Greater Security, No Matter What

Regardless of a retailer's size, the e-commerce storefront is really the only offering your consumer truly interacts with. Beyond a vehicle for sales and personalization, the storefront serves as the front line for the intake of customer data. When building this site, DTC brands and retailers should look for a platform that combines security and expert advice to protect themselves from a potential breach and ensure consumer trust is maintained.

Decrease Your Liability With Proper Payment Partners

For hackers, nothing is more important than customer payment data. After all, what they are ultimately after is money, right? One way to mitigate risk and safeguard your customers' data is by removing the temptation all together and keeping sensitive, personal information in a completely different place - with a payment gateway partner. Payment gateways not only encrypt all consumer data but work across international borders to operate smoothly with any privacy policy.

What's To Come

Data security is a must for brands and retailers. It is important, not only from a brand reputation perspective but also from a consumer confidence perspective, that consumer data is protected at all costs. Key decision makers at retailers big and small should ensure they have these processes nailed down to build success and keep their customers secure. forbes.com

Cybersecurity Budgets Set to Increase in 2022
Overly Complex IT Infrastructures Pose Security Risk

Cybersecurity budgets are set to increase in 2022, but companies worry that complex IT networks and data infrastructure are wasting money, new PwC survey finds.

More than two-thirds of companies plan to increase their cyber budget in 2022 to better protect their systems and data, with more than half of executives fearing an increase in reportable attacks, new data from consulting firm PricewaterhouseCoopers shows.

Yet the major threat to companies is an avoidable level of unnecessary complexity that has led to increased risk, with three-quarters (75%) of executives agreeing that their organization's infrastructure has become too complex and nearly the same number agreeing that complexity has led to concerning levels of risk, according to the report. Overall, executives worry that complexity will primarily lead to breaches and financial losses but also hamper innovation and undermine operational resilience.

Organizations need to focus on simplifying their operations and infrastructure and determine whether complexity is necessary, according to PwC's new "2022 Global Digital Trends Insights" report.

"The consequences for an attack rise as our systems' interdependencies grow more and more complex," the report states. "Critical infrastructures are especially vulnerable. And yet, many of the breaches we're seeing are still preventable with sound cyber practices and strong controls."

The Global Digital Trust Insights Survey annually polls more than 3,600 business, technology, and security executives, focusing on primarily (62%) large companies with at least $1 billion in revenue. While 69% of companies expect to increase their cyber budgets in 2022, and 26% expect an increase of 11% or more, many organization are not yet seeing a payoff from their investments in security.

More than half of companies have invested in cloud security, security awareness training, or endpoint security, but only roughly a third of those companies are achieving the benefits of those implementations, according to the "2022 Global Digital Trust Insights" report. darkreading.com

Google Cybersecurity Action Team
Google Launches Security Advisory Service, Security to Workspaces

Internet giant aims to help companies use the cloud securely and adds more security features to its productivity workspaces to better compete with Microsoft.

Google has launched a new service group - the Google Cybersecurity Action Team - to provide strategic advisory, compliance, threat intelligence, and incident response services aimed at helping government and corporate clients tackle complex cybersecurity efforts, the company announced today at its Next '21 conference.

The Cybersecurity Action Team will also work with clients to engineer a combination of services and systems to meet regulatory and corporate requirements. In addition to its advisory services, Google announced its Work Safer program, which will focus on hybrid work environments with a combination of the company's productivity and security products, along with third parties, such as Palo Alto Networks and CrowdStrike.

The aim is to help organizations create a security strategy and implement that strategy across hybrid environments crossing on-premises, data center, and cloud infrastructure, Phil Venables, CISO of Google Cloud, said in a press briefing. darkreading.com

List of IT assets an attacker is most likely to target for exploitation

E-commerce's Biggest Problem: Returns
Free Returns Are Complicated, Laborious, and Gross

What happens to the stuff you order online after you send it back?

This explosive growth in online sales has also magnified one of e-commerce's biggest problems: returns. When people can't touch things before buying them-and when they don't have to stand in front of another human and insist that a pair of high heels they clearly wore actually never left their living room-they send a lot of stuff back. The average brick-and-mortar store has a return rate in the single digits, but online, the average rate is somewhere between 15 and 30 percent.

For clothing, it can be even higher, thanks in part to bracketing-the common practice of ordering a size up and a size down from the size you think you need. Some retailers actively encourage the practice in order to help customers feel confident in their purchases. At the very least, many retailers now offer free shipping, free returns, and frequent discount codes, all of which promote more buying-and more returns. Last year, U.S. retailers took back more than $100 billion in merchandise sold online.

All of that unwanted stuff piles up. Some of it will be diverted into a global shadow industry of bulk resellers, some of it will be stripped for valuable parts, and some of it will go directly into an incinerator or a landfill.

It sounds harmful and inefficient-all the box trucks and tractor trailers and cargo planes and container ships set in motion to deal with changed minds or misleading product descriptions, to say nothing of the physical waste of the products themselves, and the waste created to manufacture things that will never be used. That's because it is harmful and inefficient.

Retailers of all kinds have always had to deal with returns, but processing this much miscellaneous, maybe-used, maybe-useless stuff is an invention of the past 15 years of American consumerism. In a race to acquire new customers and retain them at any cost, retailers have taught shoppers to behave in ways that are bad for virtually all involved. theatlantic.com

Online Shopping Scams
How to tell real products from scams when shopping online

It's hard to tell what's good or bad quality online. Use these research skills to avoid getting duped.

Here's how to spot red flags that a brand isn't what it says it is, whether it's on Amazon, Walmart, Google, Facebook or Instagram.

Look for a website, social media presence and contact information

Look for any evidence that the company exists outside of the first ad or listing you see. A dedicated website is a good start, but these can also be created on the cheap with tools like Shopify and WordPress. Scroll to the bottom of the front page to look for the contact details in the footer and see if it's a template. Look for an "About us" page. If it sounds original and names any founders or employees, that's a good sign. Most will have an email address, but look for more ways to contact the company, including an address and a phone number. The more reachable they are, the better.

Look up the company's age and what else it sells

Tech companies, including Google and Facebook, have started providing more information to help shoppers identify a suspicious brand, like how long it has been around. If you see a brand has only had its URL or social media pages for two years or less, keep researching.

Know when cheap is too cheap

It's possible to buy a plastic salad spinner online for under $5. While there's a chance it could be perfectly adequate at drying lettuce for years to come, if the price is significantly lower compared with brand-name spinners (around $30) it is likely to fall apart sooner. This matters more for some products than it does for others. While a cheap spinner probably still goes in circles, anything you consume, like supplements or any devices that could injure you like a treadmill, shouldn't go for drastically lower than standard pricing. washingtonpost.com

Walmart in exclusive merchandise deal with Netflix

DOJ: 'Retail theft on a massive scale': father-daughter duo sentenced in multi-million dollar shoplifting scheme
Call it a five-million finger discount. A father-daughter duo from Atlanta have been sentenced to more than five years in prison for deploying an army of professional shoplifters to steal millions of dollars of merchandise from retailers such as CVS and Target and then selling the goods online. Robert Whitley, 70, and his daughter, Noni Whitley, 47, were accused of running the scheme for nearly a decade and organizing the theft of $6.1 million worth of merchandise before being busted in 2019, prosecutors said. The pair pleaded guilty in April to interstate transportation of stolen property. Prosecutors at the time described the Whitleys' operation as a "well-organized criminal enterprise disguised as an apparently legitimate small business." "This is retail theft on a massive scale," said Kurt Erskine, the acting U.S. attorney for the northern district of Georgia. Robert Whitley was sentenced to five years and 10 months in prison and Noni Whitely was sentenced to five years. They were also ordered to pay $4.35 million in restitution. Messages left with attorneys for the Whitleys weren't immediately returned. Prosecutors say Robert Whitley - who also went by Mr. Bob - and his daughter would give shoplifters lists of items they were looking for, like razor blades, toothpaste, cosmetics and over-the-counter drugs such as Prilosec, Rogaine and Claritin. marketwatch.com

Staten Island, NY: Five charged in Million Dollar Gift Card Scheme
District Attorney Michael E. McMahon on Wednesday announced that a multi-month investigation into an alleged gift card scheme resulted in the arrest of five individuals and the seizure of more than $1 million worth of unused Apple gift cards, products, and cash. The long-term probe found a group of individuals between July and September of this year illegally obtained gift cards by using information previously stolen from American Express account holders before using those cards to purchase legitimate Apple gift cards. The individuals then allegedly used those cards to purchase Apple products from the Apple store at the Staten Island Mall, according to a release by the district attorney's office.

The raid netted $118,000 in cash, around $787,000 in unused Apple gift cards, over 180 assorted gift cards and more than six dozen new, unopened Apple products, according to McMahon's office, which thanked Apple and American Express for cooperating with the investigation. "My office will always remain vigilant against scams and other schemes and we encourage anyone who thinks they have been a victim of a scam to contact my office," said McMahon. silive.com

Mount Pleasant, WI: Woman allegedly tried to steal over $1,100 worth of items from Menards, had illegal drugs in purse

Glen Rock, NJ: Man arrested at CVS attempting to steal $761.00 worth of merchandise

Columbus, OH: Reward offered for information in theft from North Side Lowe's